← 返回 Skills 市场

feishui-file-sender

Name: feishui-file-sender
Author: josephyb97

作者 Josephyb97 · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

666

总下载

当前安装

版本数

在 OpenClaw 中安装

/install feishui-file-sender

功能描述

Send files via Feishu channel using message tool with filePath parameter.

使用说明 (SKILL.md)

Feishu File Sender

Send binary files (ZIP, PDF, images, etc.) to Feishu groups or users.

Prerequisites

OpenClaw configured with Feishu channel
Target chat ID (group or user)

Step 1: Package the Skill/File

cd /root/.openclaw/workspace/skills
zip -r /tmp/skill_name.zip skill_folder/

Key: Use relative path inside the zip, not absolute path.

Step 2: Send via Feishu

message(
    action="send",
    channel="feishu",
    filePath="/tmp/skill_name.zip",
    message="📦 Skill Name",
    target="oc_xxxxxxxxxxxx"  # chat ID
)

Parameters

Parameter	Type	Required	Description
action	string	Yes	"send"
channel	string	Yes	"feishu"
filePath	string	Yes	Absolute path to file
message	string	Yes	Caption text
target	string	Yes	Chat ID (oc_xxx for groups, user ID for DM)

Common Issues

File too large: Feishu limits apply (~20MB for most)
Wrong path: Use absolute path /tmp/xxx.zip
Relative path in zip: Package from parent dir, e.g., zip -r /tmp/out.zip folder/

Example: Send a Skill

# Package
cd /root/.openclaw/workspace/skills
zip -r /tmp/weather.zip weather/

# Send
message(action="send", channel="feishu", filePath="/tmp/weather.zip", message="📦 weather skill", target="oc_group_id")

安全使用建议

This skill will let the agent package files from the agent workspace and send them to a Feishu chat using the platform's messaging capability. That is coherent with its description, but it is also a straightforward channel for data exfiltration if misused. Before installing or enabling it: (1) Confirm the Feishu channel and destination chat ID are trusted and under your control; (2) Avoid allowing the agent to zip or send directories that may contain secrets (API keys, private keys, credentials, logs); (3) Require explicit, human-confirmed file paths and a checklist of what will be sent rather than allowing arbitrary paths; (4) Inspect or lock down the implementation of the message(...) tool to ensure it enforces sender policies/rate limits and logs actions; (5) Prefer running this skill in a restricted test environment first. If you cannot enforce those safeguards, do not enable this skill for autonomous use.

功能分析

Type: OpenClaw Skill Name: feishui-file-sender Version: 1.0.0 The `SKILL.md` file instructs the AI agent to `cd` into `/root/.openclaw/workspace/skills` and use the `zip` command to package directories. The skill then uses the `message` tool with a `filePath` parameter that accepts absolute paths. This combination, while intended for sending other skills, creates a significant prompt injection vulnerability. An attacker could potentially instruct the agent to zip and exfiltrate arbitrary sensitive files or directories (e.g., `/etc`, `~/.ssh`, or other skill data) by manipulating the `zip` command's target or the `filePath` parameter. This grants a high-risk capability that could be abused, but the provided files do not show explicit malicious intent to self-exploit or exfiltrate unrelated data.

能力评估

ℹ Purpose & Capability

Name/description (send files to Feishu) align with the instructions: the SKILL.md shows how to package a skill folder and call message(..., channel='feishu', filePath=...). However the instructions specifically target /root/.openclaw/workspace/skills (agent internal workspace), which expands the capability beyond a generic 'send a chosen file' scenario and is worth calling out.

⚠ Instruction Scope

The SKILL.md tells the agent to run shell commands that read and zip files from the agent's workspace (/root/.openclaw/workspace/skills) and then to call message(...) with an absolute filePath. This explicitly instructs reading local agent files and transmitting them to an external Feishu target. There are no constraints, confirmation steps, or sanitization rules — the agent could be directed to package and send any files inside the workspace (which may include secrets). That broad I/O and transmission behavior is the main risk.

✓ Install Mechanism

Instruction-only skill with no install spec and no code files — nothing written to disk by an installer. This minimizes installation risk.

ℹ Credentials

The skill declares no required environment variables or credentials, which is expected because it relies on the OpenClaw 'message' tool and the platform's configured Feishu channel. However, that means the skill implicitly uses the agent's Feishu credentials to transmit files; the lack of any explicit credential declaration is not wrong but you should verify the channel configuration and who controls the destination chat ID.

✓ Persistence & Privilege

always:false and no install or code that modifies agent configuration are present. The skill does not request permanent presence or elevated privileges beyond invoking the message/send flow at runtime.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install feishui-file-sender
安装完成后，直接呼叫该 Skill 的名称或使用 /feishui-file-sender 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

feishu-file-sender 1.0.0 - Initial release. - Allows sending binary files via Feishu channel using the message tool with a filePath parameter. - Supports targeting both Feishu groups and users. - Includes usage instructions, parameter descriptions, and troubleshooting tips.

元数据

Slug feishui-file-sender

版本 1.0.0

许可证 —

累计安装 0

当前安装数 0

历史版本数 1

常见问题